CVE-2025-45752 | High | 7.2 | 2025-05-21 | A vulnerability in SeedDMS 6.0.32 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the zip import functionality in the Exte… |
CVE-2025-45754 | Medium | 5.4 | 2025-05-21 | A stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32. This vulnerability allows an attacker to inject malicious JavaScript payloads by cr… |
CVE-2025-25461 | Medium | 5.4 | 2025-02-28 | A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS… |
CVE-2024-46409 | Medium | 5.4 | 2024-10-04 | A stored cross-site scripting (XSS) vulnerability in SeedDMS v6.0.28 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload… |
CVE-2021-39421 | Medium | 6.1 | 2023-07-24 | A cross-site scripting (XSS) vulnerability in SeedDMS v6.0.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2021-39425 | Medium | 6.1 | 2023-07-20 | SeedDMS v6.0.15 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulnerability to redirect users to arbitrary web URLs by… |
CVE-2021-33223 | High | 8.8 | 2023-06-07 | An issue discovered in SeedDMS 6.0.15 allows an attacker to escalate privileges via the userid and role parameters in the out.UsrMgr.php file. |
CVE-2022-44938 | Critical | 9.8 | 2022-12-08 | Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack. |
CVE-2022-28479 | Medium | 4.8 | 2022-06-06 | SeedDMS versions 6.0.18 and 5.1.25 and below are vulnerable to stored XSS. An attacker with admin privileges can inject the payload inside the "Role management… |
CVE-2022-28478 | Medium | 6.5 | 2022-06-06 | SeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal. The "Remove file" functionality inside the "Log files management" menu does not sanitize user… |
CVE-2022-28051 | Medium | 5.4 | 2022-06-06 | The "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version 6.0.18 and 5.1.25, is prone to stored XSS which allows an attacker to i… |
CVE-2021-45408 | Medium | 6.1 | 2022-02-04 | Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sites using the "refer… |
CVE-2020-23048 | Medium | 6.1 | 2021-10-22 | SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS) vulnerability in the component AddEvent.php via the name and comment… |
CVE-2021-36543 | Medium | 4.3 | 2021-08-03 | Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x <5.1.23 and v6.0.x <6.0.16 allows a remote attacker to unloc… |
CVE-2021-36542 | Medium | 4.3 | 2021-08-03 | Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x<5.1.23 and v6.0.x <6.0.16 allows a remote attacker to lock any… |
CVE-2021-35343 | Medium | 4.3 | 2021-08-03 | Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x<5.1.23 and v6.0.x<6.0.16 allows a remote attacker to edit document nam… |
CVE-2021-26216 | Medium | 4.3 | 2021-03-18 | SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php. |
CVE-2021-26215 | Medium | 4.3 | 2021-03-18 | SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php. |
CVE-2020-28727 | Medium | 6.1 | 2020-12-07 | Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter to views/bootstrap/class.DropFolderChooser.php. |
CVE-2020-28726 | Medium | 6.1 | 2020-11-24 | Open redirect in SeedDMS 6.0.13 via the dropfolderfileform1 parameter to out/out.AddDocument.php. |
CVE-2019-12932 | Medium | 6.1 | 2019-06-28 | A stored XSS vulnerability was found in SeedDMS 5.1.11 due to poorly escaping the search result in the autocomplete search form placed in the header of out/out… |
CVE-2019-12745 | Medium | 5.4 | 2019-06-20 | out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting (XSS) via the name field. |
CVE-2019-12744 | High | 7.5 | 2019-06-20 | SeedDMS before 5.1.11 allows Remote Command Execution (RCE) because of unvalidated file upload of PHP scripts, a different vulnerability than CVE-2018-12940. |
CVE-2019-12801 | Medium | 6.1 | 2019-06-17 | out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the "GROUP" Name. |
CVE-2018-12944 | Medium | 6.1 | 2018-07-31 | Persistent Cross-Site Scripting (XSS) vulnerability in the "Categories" feature in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows remote attackers to… |
CVE-2018-12943 | Medium | 6.1 | 2018-07-31 | Cross-Site Scripting (XSS) vulnerability in every page that includes the "action" URL parameter in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows rem… |
CVE-2018-12942 | High | 8.8 | 2018-07-31 | SQL injection vulnerability in the "Users management" functionality in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows authenticated attackers to mani… |
CVE-2018-12941 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 by adding a system command at the end… |
CVE-2018-12940 | High | 8.8 | 2018-07-31 | Unrestricted file upload vulnerability in "op/op.UploadChunks.php" in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows remote attackers to execute arbi… |
CVE-2018-12939 | Medium | 6.5 | 2018-07-31 | A directory traversal flaw in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows an authenticated attacker to write to (or potentially delete) arbitrary… |
CVE-2014-2279 | | | 2014-10-17 | Multiple directory traversal vulnerabilities in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allow (1) remote authenticated users with access to the LogMa… |
CVE-2014-2278 | | | 2014-10-17 | Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to execute arbitrary… |
CVE-2014-2280 | | | 2014-03-20 | Cross-site scripting (XSS) vulnerability in the search feature in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to inject arbitrary… |